Evidence moves between device and remote services.
Messages, emails, documents, logins and application activities can be distributed across smartphones, backups, cloud tenants and third-party systems. Mobile and cloud forensics therefore requires a strategy that considers the availability, volatility, permissions and limitations of each source.
Mobile devices
- device identification, status and acquisition conditions;
- logical collection or file-system when technically possible and authorized;
- analysis of applications, communications, files and metadata;
- reconstruction of activities and temporal sequences;
- check available backups and related sources;
- documentation of tools, versions and technical limitations.
Cloud environments
- audit log of Microsoft 365, Google Workspace and SaaS services;
- accesses, sessions, MFA, applications and consents;
- mailbox rules, forwarding and administrative tasks;
- sharing, downloads, deletions and modifications;
- correlation between identity provider, mail, storage and endpoint;
- verification of retention periods and information gaps.
Results
The client receives an inventory of sources, a timeline and a report that distinguishes present data, inferences and non-recoverable information. Access to the services occurs exclusively with authorizations and credentials made available by the legitimated subject.